Social Security Administration Seeing High Number Of Scams

The Federal Trade Commission (FTC) recently issued a public service announcement regarding the growing number of Social Security related scams they’ve been getting reports about.

In 2017, just 3,200 people called to report instances of SSA Voice Phishing (called ‘vishing’), with total 2017 losses amounting to some $210,000.

In 2018, that number swelled to more than 63,000 with losses in excess of $16.6 million.  Even worse, these statistics don’t tell the full extent of the story or the amount of growth. That’s because of course, not everyone who falls victim to such scams calls in to report them. So the overall number and the corresponding dollar amount lost is no doubt much higher.

As to the scam itself, there are obviously a number of variations, but broadly speaking, they all follow the same basic script.  A scammer calls, pretending to be someone from the Social Security Administration.  They inform the person they’re speaking to that they’re calling because suspicious activity was spotted as relates to the person’s account (credit applications and the like).

This, they inform the potential victim, has caused their social security to be blocked and suspended, and warn the victim that it’s possible that their bank accounts may be seized as a result of the suspicious activity.

It’s ham-fisted and transparent, but it works a shocking percentage of the time.  Fearful of being cut off and potentially locked out of their life savings, the victims proceed to gladly hand over any and all information the phony SSA official says they need to put the matter right.  That of course includes verification of the victim’s social security number and all their banking information.

Needless to say, it doesn’t end well for the person who hands over all this information. Be aware of it, and make sure any seniors you know are aware of it too.  Anything we can do, collectively, to help stem this tide is a very good thing.

Ransomware Attackers Targeting Larger Companies For More Money

If you haven’t heard of the GrandCrab ransomware strain, it’s something you should put on your company’s radar.  It first emerged as a viable threat in early 2018.

Since that time, its creators have been constantly tweaking and honing their approach, turning it into a devastatingly effective strain.

The latest version GrandCrab 5.2 was released in February 2019, and researchers at Crowdstrike have been digging into both the software and the operating tactics of the group responsible for it.  Their findings are disturbing to say the least.

The creators of GrandCrab are essentially operating their software under and affiliate scheme, where the owners of the software deploy it on behalf of hacker clients, offering it as a service for hire in exchange for 30-40 percent of the profits.  The company is even advertising on black hat forums and across the Dark Web, using ads designed specifically to pique the interest of other hackers in the community.

In addition to that, GrandCrab’s creators are ramping up their own efforts. They are increasingly ignoring smaller targets in preference for large companies with sprawling global networks, seeking a greater infection percentage (and a correspondingly higher payday).

The plan works like this:  Once they get a hold inside a corporate network, rather than triggering the infection immediately, they explore the space and try to use their beach head to expand the number of machines their infectious software resides on.  Only when they’ve achieved deep network penetration that spans a large percentage of the company’s networked machines do they trigger the infection. This results in the mass encryption of files across much (if not all) of the target network, instantly bringing the company to its knees.

The researchers have taken to calling this approach ‘Big Game Hunting’ for obvious reasons., It is proving to be brutally effective because statistically, infected companies are more likely than not to pony up the ransom money being demanded.

All that to say the hackers are getting increasingly savvy and organized.  Don’t let your guard down.

Survey Shows Identity Theft Is Common For Americans

How big of a problem do you imagine identity theft to be?  What percentage of Americans do you think have been impacted by it? If you’re like most people, whatever number you selected probably underestimated its impact.  In a recent survey conducted by nCipher, it was discovered that nearly 29 percent (17.6 percent) of respondents admitted that their identities had been stolen.

As a percentage, that may not seem like all that much, although it’s certainly disturbing.  When you consider that the United States is home to some 330 million people, taking 17.6 percent of that yields the depressingly large number of 58,080,000.

Compare that figure to the 2017 estimate of 16.7 million instances of identity theft, and the rampant growth of this type of crime suddenly comes into striking and dismaying focus. If that wasn’t bad enough, a further 16.5 percent of survey respondents said that they had no idea whether they’d had their identity stolen or not.

It’s certainly not fair to conclude that all of the people in this group have had their identities stolen and simply aren’t aware of it.  The simple fact that such a large group of people seem to have little to no awareness of their digital footprint and who might have access to it is beyond disturbing.

The two biggest takeaways from the survey are these:

One: Identity theft is a rapidly growing crime that impacts tens of millions of Americans and it’s growing more common by the day.

Two: A shocking percentage of people have almost no awareness about how secure their digital footprint is, which means they have no real understanding of how to protect themselves from identity theft.

Given the rapid growth in this type of crime, it’s fair to say that sooner or later, most of the people in the second statistic will wind up as part of the first.  Make sure you’re not in either group!

Creator Of Popular Kids App Fined For Privacy Violations

The Federal Trade Commission just issued an enormous fine to a Chinese app developer for illegally collecting the personal data of the children who used it.

The company was handed a staggering $5.7 million fine when the FTC filed a complaint alleging that the video-sharing app was in violation of the Children’s Online Privacy Protection Act.

Their mistake was that the app did not require parental consent from users under the age of 13 before collecting personal information. As with many apps of this type, this one (called Tik Tok) collected vast amounts of information. This included user names, email addresses, first and last names, phone numbers, profile pictures, user-entered biographical information, location data, and more.

In addition to the obvious COPPA violations, the app’s development team came under fire when it was discovered that much of each user’s account information remained visible to the general public, even if the user opted to make their profile private.

Worst of all, in the FTC filing, it was noted that adults had made numerous attempts to contact children via the app. It also stated that until the company released an update in 2016, there was a feature in place that allowed a user to view all other signed-in users within a fifty-mile radius of their location.

The general state of app security and permissions is quite poor, but even given the relatively low standards in today’s market, the Tik Tok app sets new lows on several different fronts.  The hefty fine levied by the FTC was not only wholly justified, but it is hoped, will serve as a warning shot across the bow of app developers to start cleaning up their collective acts a bit, especially when marketing apps to children.

John Fokker, the head of Cyber Investigations at McAfee applauded the ruling, but also cautioned:

“…the responsibility also lies with parents to ensure their children are only signing up for services they’re old enough and wise enough to use.”

Wise words indeed, and kudos to the FTC.

2018 Was The Record Breaking Year For Data Breaches

We knew fairly early in the year that 2018 was on track to beat 2017 and set a new record for the number of data breaches in the year.

Afterall, 2017 had shattered 2016’s record the year before.  Now that the final numbers are in though, we can see just how big an increase we’ve seen in the number of data breaches from one year to the next.

The numbers aren’t pretty.  With 12,449 reported data breaches in 2018, we’ve seen a staggering 424 percent increase year over year. 2019 is already shaping up to be another record-breaking year.  All that to say, our problems with hackers and data security are getting worse, and there’s no end in sight.

As with last year, the United States leads the pack in terms of the total number of records exposed by data breaches. Although in terms of raw numbers, the US’s total was fairly modest. It’s simply that all of the year’s biggest breaches occurred here.

At least part of what’s driving the phenomenon of the steadily increasing number of breaches is the fact that there are a staggering number of user login credentials for sale and re-sale on the Dark Web.  These are purchased for modest sums and used by hacking groups all over the world to try their hand at breaking into various networks.

Unfortunately, given the sorry state of password security, it’s often months before a hacked account sees its password changed. That gives nefarious elements plenty of time and loads of opportunities to inflict whatever damage they will, and they’re only too happy to comply.

With the grim statistics above firmly in mind, it’s time to make data security at your firm your top priority.  Based on the numbers, it’s not a question of whether you’ll be hacked.  It’s only a matter of when.